Skip to content
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2275 commits
Select commit Hold shift + click to select a range
bc1c328
Update TLS migration job to create envoy-gateway-system namespace first
woojae-siloai Apr 22, 2026
8e124a6
Add TLS secret copy job without certificate modification
woojae-siloai Apr 23, 2026
15c28dd
feat: update templates so storageClassName can be set via helm templa…
Q-Dub Apr 23, 2026
72675ae
add grafana httproute, add user info in openbao script, require login…
oskarasbrink Apr 23, 2026
e3c1f17
Update restart job service account for envoy-gateway migration
woojae-siloai Apr 23, 2026
27da0e5
require grafana login, not yet required
oskarasbrink Apr 23, 2026
bc00d21
remove PreSync hooks from ExternalSecrets to resolve ArgoCD sync bloc…
woojae-siloai Apr 23, 2026
b3592f3
initial cluster-health-overview dashboard
oskarasbrink Apr 23, 2026
23275e0
fix: add premade dashboards, rename cluster-overview dashboard
oskarasbrink Apr 23, 2026
ac75636
docs(byok): add aiwb helm chart and pluggable component scripts and docs
Q-Dub Apr 23, 2026
ed6bc13
fix: remove preinstall dashboards from root/values
oskarasbrink Apr 23, 2026
4442eb0
docs(pluggable): mv entrypoint README.md up to /docs level and update…
Q-Dub Apr 24, 2026
6bd1da5
fix(byok): fix logic of waiting for Keycloack when BYO_DB=true
Q-Dub Apr 24, 2026
7a26b2a
fix(byok): update all BYO refs to pluggable
Q-Dub Apr 24, 2026
50e2864
chore(byok): cleanup remaining BYO refs
Q-Dub Apr 24, 2026
07df3ca
fix: set -euo line and remove homebrew files
Q-Dub Apr 24, 2026
da35975
fix: update poc_helm_byok ref to main
Q-Dub Apr 24, 2026
1089650
fix: remove aiwb-cnpg value overrides
Q-Dub Apr 24, 2026
f969f3b
fix(byok): use kserve-system as namespace deafult explicitly to avoid…
Q-Dub Apr 24, 2026
7f77285
fix: rm vendored changes
Q-Dub Apr 24, 2026
77fff48
Merge pull request #695 from silogen/poc_helm_byok
Q-Dub Apr 24, 2026
410a45f
feat(helm-install): add post_install.sh script
Q-Dub Apr 24, 2026
c14ec49
ux: pluggable -> manual_helm_install
Q-Dub Apr 24, 2026
b77b658
fix: redeploy kserve after webhooks are ready
Q-Dub Apr 24, 2026
7a5d823
add the gpu operator to the helm-install
brownzebra Apr 24, 2026
c64eb74
updates for gpu operator race condition
brownzebra Apr 24, 2026
11aa5d7
fix(byok): point the default object storage api url outside of cluster
pre Apr 24, 2026
6ecf992
doc(byo): Explain the need for in-cluster Minio redirect with BYO S3
pre Apr 27, 2026
759f543
feat: require DOMAIN for install_base.sh and update docs
Q-Dub Apr 27, 2026
c41db3a
setting proper domain when testing in cloud
brownzebra Apr 27, 2026
62b469d
fix: set default as default sc; feat: add keda and kedify and OTel
Q-Dub Apr 27, 2026
0ce7eb9
keda-operator typo
brownzebra Apr 27, 2026
7d65a1c
feat: add prometheus
Q-Dub Apr 27, 2026
a6d857c
feat: add modeals for AIMS 0.9 and 0.10
Q-Dub Apr 27, 2026
94e1916
getting models to load via the aim-engine
brownzebra Apr 27, 2026
c63341d
fix(byok): Pass parameters to install_base.sh
pre Apr 28, 2026
d11e310
shim cluster-auth for standalone helm-only instructions
brownzebra Apr 27, 2026
8e424aa
fork aiwb to shim the cluster-auth
brownzebra Apr 28, 2026
a8976df
chore(byo): Parametrize cluster-forge branch
pre Apr 28, 2026
29dac46
fix: Remove openbao-init from ArgoCD management to prevent rerun on t…
woojae-siloai Apr 28, 2026
76d6241
fix stale block in install_base and add cluster-auth-shim.py
brownzebra Apr 28, 2026
4f4018b
patching cpu limits away for workload startup
brownzebra Apr 28, 2026
6fe07e2
fix(byo): Set default values for PLUGGABLE_* as false
pre Apr 28, 2026
cbee48f
fix(byo): Fix conditional of PLUGGABLE_GW
pre Apr 28, 2026
03e0e42
doc(BYO): Fix links in README
pre Apr 28, 2026
ec6412a
doc(BYO): Write section for Known Workarounds
pre Apr 28, 2026
3fe0baf
Merge pull request #694 from silogen/EAI-5784_byok_documentation
pre Apr 28, 2026
fa0cc97
EAI-5784: gate ExternalSecret/SecretStore resources behind externalSe…
pre Apr 27, 2026
67f3305
EAI-5784: parametrize keycloak-old PostgreSQL connection (cnpg.enable…
pre Apr 27, 2026
339318e
EAI-5784: fix keycloak-old hardcoded values, retire install_base.sh s…
pre Apr 27, 2026
5551ab6
fix(byo): Change Minio listen port to 9999 on host
pre Apr 28, 2026
63821e1
chore(byo): Skip cnpg-operator install when PLUGGABLE_DB=true
pre Apr 28, 2026
c24e3dd
EAI-5784: implement PLUGGABLE_DB=true in install_base.sh, deprecate d…
pre Apr 28, 2026
1d45447
chore(byo): Remove deprecated db.sh
pre Apr 28, 2026
7d7bc80
chore(byo): Skip installing cnpg-operator when PLUGGABLE_DB=true
pre Apr 28, 2026
74fecb0
fix(keycloak-old): Do not hide and ignore errors
pre Apr 28, 2026
f77662c
Merge pull request #697 from silogen/EAI-6050_refactor_helm_1
pre Apr 28, 2026
cb234d0
chore(byok): Read default value for DEFAULT_STORAGE_CLASS_NAME
pre Apr 28, 2026
020f7d0
fix(byok): Use "main" branch for cluster-forge
pre Apr 28, 2026
4601747
fix(byok): Always initialize the repo from scratch with FORCE_UPDATE
pre Apr 28, 2026
3c7ec21
chore(byok): Read default value for CLUSTER_FORGE_BRANCH
pre Apr 28, 2026
722366c
Merge pull request #698 from silogen/EAI-6050_fix-default-values
pre Apr 28, 2026
fc80710
chore(byo): Split CNPG and MinIO secrets into separate files
pre Apr 29, 2026
b68a14c
chore(byo): Move S3 redirect Service and credential creation into ins…
pre Apr 29, 2026
6484952
chore(byo): Reduce s3.sh to a post-install verification script
pre Apr 29, 2026
50aa043
docs(byo): Rewrite db.md and s3.md for pluggable.sh-based install flow
pre Apr 29, 2026
4e3925a
fix(byo): pluggable.sh respects pre-set PLUGGABLE_* env vars
pre Apr 29, 2026
5fe88a6
chore(byo): Clean up pre-existing minio Service before applying redirect
pre Apr 29, 2026
cb68325
docs(byo): Update s3_minio_container.sh to point at pluggable.sh
pre Apr 29, 2026
d6179dd
fix(byo): Default MINIO_ACCESS_KEY/SECRET_KEY in install_base.sh
pre Apr 29, 2026
67a1b34
fix(byo): Make kgateway tokenreviews patch in install_base.sh idempotent
pre Apr 29, 2026
7554115
Merge branch 'main' into EAI-5893_feat_multiple_helm_value_files
Q-Dub Apr 29, 2026
35b89a8
fix(bootstrap.sh): batch fixes -
Q-Dub Apr 29, 2026
f282874
fix(sbom): Updated kaiwo version from v0.2.0-rc11 to v0.2.0-rc12
Q-Dub Apr 29, 2026
82104c8
Merge pull request #692 from silogen/EAI-5893_feat_multiple_helm_valu…
Q-Dub Apr 29, 2026
810ac7f
Merge pull request #696 from silogen/EAI_2309_openbao_init_fix
oskarasbrink Apr 29, 2026
8a271a6
Merge pull request #699 from silogen/EAI-6059_replace_byo_s3_in_sources
Q-Dub Apr 29, 2026
3061487
feat: switch to oci images (aim-engine, aiwb, kaiwo) and add multi-so…
Q-Dub Apr 29, 2026
ff5c200
fix: sbom CI
Q-Dub Apr 29, 2026
1d42907
fix: ref dockerhub oci images (by sha)
Q-Dub Apr 30, 2026
8332704
fix(sbom): regenerate
Q-Dub Apr 30, 2026
54ff300
fix: batch fixes to resolve failed linting CI
Q-Dub Apr 30, 2026
48a3eb0
fix: support for optional path when using OCI image ref and addition …
Q-Dub Apr 30, 2026
6d16f08
fix(sbom): update component list
Q-Dub Apr 30, 2026
e8b848e
config(kaiwo): no need for values.yaml overrides
Q-Dub Apr 30, 2026
089da0c
fix(sbom): support oci images
Q-Dub Apr 30, 2026
94578b5
feat: enhance cluster health overview dashboard with GPU detection an…
oskarasbrink Apr 30, 2026
e67032c
EAI-5646: Cross-reference core INSTALL.md and add AIRM integration gu…
kevinkswSiloAI May 1, 2026
d295ff5
config(cluster-auth): point to 0.5.9 (cache invalidation)
Q-Dub May 4, 2026
a5cd885
Merge pull request #703 from silogen/EAI-5646-cross-reference-core-in…
pre May 4, 2026
1ad9a07
chore(byo): Drop redundant aiwb/keycloak entries from override secrets
pre Apr 29, 2026
efe457b
chore(byo): Drive CNPG credential secrets from env vars
pre Apr 29, 2026
7f36859
chore(byo): Drive MinIO credential secrets from env vars + parametriz…
pre Apr 29, 2026
4ea7c58
docs(byo): Rewrite db.md and s3.md as self-sufficient install guides
pre Apr 30, 2026
2eebabc
fix(cluster-auth): update openbao.cacheTTL and rc image pin
Q-Dub May 5, 2026
3baee5f
Merge pull request #700 from silogen/EAI-5957_oci_images
Q-Dub May 7, 2026
46b176a
fix: point to correct image version and align cacheTTL
Q-Dub May 7, 2026
381a5df
fix(sbom): sync after cluster-auth image bump
Q-Dub May 7, 2026
cf4be1e
Merge pull request #704 from silogen/EAI-5995_cache_invalidation
Q-Dub May 7, 2026
7c824dd
EAI-5821: Enable aim-engine clusterRuntimeConfig for envoy-gateway
johnl-amd May 7, 2026
c922d88
Merge pull request #701 from silogen/EAI-6099-helm-set-3
pre May 7, 2026
2b2b61f
add basic GPU utliziation monitoring to cluster-health-overview dashb…
oskarasbrink May 8, 2026
1ab5ce1
fix: adjust timing window for GPU aggregate metrics in cluster-health…
oskarasbrink May 8, 2026
ec16062
Partially revert EAI-5893: Remove valuesFiles from single-source apps
Q-Dub May 8, 2026
1d98ed8
fix(sbom): handle OCI apps without path in validation
Q-Dub May 8, 2026
ea9367b
fix: strip v from version
Q-Dub May 8, 2026
b69094f
fix: use path instead of chart for OCI Helm repositories
Q-Dub May 8, 2026
23868b0
fix: aim-engine-crds stip v from version
Q-Dub May 8, 2026
ec7f59c
Merge pull request #708 from silogen/revert-EAI-5893-selective
Q-Dub May 8, 2026
641a5e3
Merge branch 'main' into EAI_5821_evaluate_envoy_gateway
woojae-siloai May 12, 2026
afca9f7
update components.yaml
woojae-siloai May 12, 2026
f740a40
update components.yaml
woojae-siloai May 12, 2026
004df76
update 0.5.9 of cluster-forge for envoy-gateway
woojae-siloai May 12, 2026
5dd8497
update 0.5.9 of cluster-forge for envoy-gateway
woojae-siloai May 12, 2026
f3ac26f
update 0.5.9 of cluster-forge for envoy-gateway
woojae-siloai May 12, 2026
acc7e72
add https service for coredns-config
woojae-siloai May 14, 2026
447e146
add int-test tagged oci charts to root/values.yaml instead of sources…
oskarasbrink May 15, 2026
c225077
fix: update airm,aiwb and aim-engine image tags for v2.1.0 release
oskarasbrink May 18, 2026
6ddf16f
fix: update aimclustermodelsource for 0.11 aims
oskarasbrink May 18, 2026
915da32
fix: remove epyc and aim-base from aimclustermodelsource-0.11
oskarasbrink May 18, 2026
6036471
fix 307 redirection happened at encoded urls
woojae-siloai May 18, 2026
cbc55e1
fix 307 redirection happened at encoded urls
woojae-siloai May 18, 2026
5da49dc
Merge pull request #709 from silogen/main
oskarasbrink May 18, 2026
02505d0
fix 307 redirection happened at encoded urls
woojae-siloai May 18, 2026
6a999bf
fix: cluster-health-overview didnt render for argocd
oskarasbrink May 18, 2026
bfff039
Merge pull request #707 from silogen/grafana-user-and-httproute
brownzebra May 19, 2026
951e6dd
Merge pull request #710 from silogen/main
oskarasbrink May 19, 2026
cc22a51
Revert "get grafana into v210 branch"
oskarasbrink May 19, 2026
9d93f64
Merge pull request #712 from silogen/revert-710-main
oskarasbrink May 19, 2026
f197362
Revert "Grafana user and httproute, keeping old dashboards, premade k…
oskarasbrink May 19, 2026
a16afbc
Merge pull request #713 from silogen/revert-707-grafana-user-and-http…
brownzebra May 19, 2026
bf66613
Revert "Revert "get grafana into v210 branch""
oskarasbrink May 19, 2026
44ac862
Merge pull request #714 from silogen/revert-712-revert-710-main
oskarasbrink May 19, 2026
6b0d26a
test switching dockerhub ocireg
oskarasbrink May 20, 2026
9b99616
feat: Add support for defining chart in app source
lauri-amd May 20, 2026
d30a1f5
Add nodeSelector and priorityClassName to EnvoyProxy for first-node p…
woojae-siloai May 20, 2026
1b93451
update root/values.yaml to avoid argocd polling charts
oskarasbrink May 25, 2026
7d831bc
switch to amdenterpriseai for airm/aiwb
oskarasbrink May 25, 2026
53a566f
EAI-6400 Fix GitHub compliance issues in cluster-forge
brownzebra May 25, 2026
8c83960
feat: add node labeling utilities migrated from cluster-bloom
woojae-siloai May 26, 2026
0263abb
remove dev- prefix in airm/aiwb
oskarasbrink May 26, 2026
4e51513
feat: add comprehensive envoy-gateway migration job combining TLS cop…
woojae-siloai May 26, 2026
1511679
delete jobs from top-level folder
woojae-siloai May 26, 2026
ffa88f4
docs: add comprehensive kgateway to envoy-gateway migration guide for…
woojae-siloai May 26, 2026
28f53ae
update roles for self-healing secrets
brownzebra May 19, 2026
5336100
Fix: Remove Gitea from small cluster, add Helm parameters to override…
brownzebra Apr 18, 2026
531218c
removing pre-sync annotations from es-airm-realm-credentials to get k…
brownzebra May 20, 2026
70726a7
self-heal the secrets
brownzebra May 20, 2026
bd1f68a
fix: replace PreSync hook with sync-wave on keycloak-credentials Exte…
brownzebra May 21, 2026
ab3713c
reduce keycloak-old cpu
brownzebra May 25, 2026
7bc104b
EAI-6538 Fix race condition in Keycloak preventing reliable AIRM inst…
brownzebra May 26, 2026
353bef4
Merge pull request #715 from silogen/EAI-6400-fix-git-hub-compliance-…
blankdots May 26, 2026
d18109d
fix: increase envoy-gateway-migration job memory limits to prevent OO…
woojae-siloai May 26, 2026
2b89cb9
docs: update kgateway-envoy-gateway-migration-guide
woojae-siloai May 26, 2026
9db48cc
docs: update kgateway-envoy-gateway-migration-guide
woojae-siloai May 26, 2026
b3f06a8
docs: update kgateway-envoy-gateway-migration-guide
woojae-siloai May 26, 2026
f2fa530
Merge branch 'main' into EAI-6538-fix-race-condition-in-keycloak-prev…
brownzebra May 27, 2026
5aafeef
Merge pull request #716 from silogen/EAI-6538-fix-race-condition-in-k…
silogenplatform May 27, 2026
d94565e
fix: aim-engine from 0.2.3 to 0.2.4, also aim-engine from dockerhub i…
oskarasbrink May 27, 2026
fccb896
fix: typo in root values for aiwb
oskarasbrink May 27, 2026
5c25d82
Revert "Revert "Grafana user and httproute, keeping old dashboards, p…
oskarasbrink May 27, 2026
9f4449a
sbom for v2_1_0
brownzebra May 27, 2026
bd55b63
Merge pull request #719 from silogen/revert-713-revert-707-grafana-us…
brownzebra May 27, 2026
c248c49
Merge pull request #718 from silogen/v2_1_0-rc
brownzebra May 27, 2026
7019fae
scripts removed, utils moved to cache
brownzebra May 27, 2026
5cff9d0
Merge pull request #721 from silogen/removing-bootstrap-itself
brownzebra May 28, 2026
ef7396f
Merge branch 'main' into EAI_5821_evaluate_envoy_gateway_with_nodeSel…
woojae-siloai May 28, 2026
af88e66
feat: update the version of aiwb
woojae-siloai May 28, 2026
eda4531
refactor: convert amd-gpu-operator-config to helm chart with template…
pre May 27, 2026
333505b
moving the init jobs into sources from scripts
brownzebra May 28, 2026
8c285ed
Merge pull request #723 from silogen/EAI-6604-open-bao-init-job-deplo…
brownzebra May 28, 2026
e761396
Merge branch 'main' into EAI_5821_evaluate_envoy_gateway_with_nodeSel…
brownzebra May 28, 2026
6be7160
Merge pull request #717 from silogen/EAI_5821_evaluate_envoy_gateway_…
brownzebra May 28, 2026
066c9c6
Merge pull request #720 from silogen/eai-6555_parametrized-device-config
pre May 29, 2026
9b8e64d
refactor: Use Helm .Release.Namespace in amd-gpu-operator-config
pre May 29, 2026
a53bc23
small-openbao-init-needs-local-path-storage-class
brownzebra May 29, 2026
1167509
Merge branch 'main' into small-openbao-init-needs-local-path-storage-…
brownzebra May 29, 2026
ea63429
Merge pull request #726 from silogen/small-openbao-init-needs-local-p…
brownzebra May 29, 2026
2d05e5e
small-openbao-init-needs-local-path-storage-class
brownzebra May 29, 2026
8f97cc3
Merge pull request #727 from silogen/small-argocd-challenges-with-val…
brownzebra May 29, 2026
c079385
EAI-1500 update documentation
blankdots Jun 2, 2026
5e2856c
small to contain github link directly
brownzebra Jun 2, 2026
6dafffa
Merge pull request #731 from silogen/small-argocd-challenges-with-val…
blankdots Jun 2, 2026
3669aa3
Polish envoy stuff (#732)
woojae-siloai Jun 2, 2026
35fd504
fix: remove duplicate aim
oskarasbrink Jun 5, 2026
5c701d2
Merge pull request #736 from silogen/duplicate-mistral-aimclustermodel
oskarasbrink Jun 5, 2026
c0bdc54
fix(tls): Reference correct namespace
lauri-amd Jun 8, 2026
ba78c02
Merge branch 'main' into EAI-6555_use-release-namespace-in-amd-gpu-op…
rodrodsilo Jun 8, 2026
40de21d
Merge pull request #725 from silogen/EAI-6555_use-release-namespace-i…
pre Jun 8, 2026
d770c9f
Merge pull request #738 from silogen/lauri-fix-argocd-es-source
lauri-amd Jun 8, 2026
400f234
Merge pull request #733 from silogen/EAI-1500-consolidate-and-clarify…
blankdots Jun 10, 2026
11a0cd2
EAI Suite -> EAI reference stack
haakanpersson Jun 12, 2026
455347c
Add seaweedfs-operator charts to sources
pwistbac Feb 18, 2026
6ce3689
Enable seaweedfs apps in medium size
pwistbac Feb 19, 2026
2446947
Remove hallucination
pwistbac Feb 19, 2026
1da44d7
Fix namespace name
pwistbac Feb 19, 2026
650bba1
Configure API keys for seaweedfs s3
pwistbac Feb 23, 2026
3b5215f
Disable webhook due to missing CABundle for tls
pwistbac Feb 23, 2026
76fb8fb
Fix wrong name of the s3 creds secret for seaweed
pwistbac Feb 23, 2026
e6901be
Fix malformed json
pwistbac Feb 23, 2026
6aea439
Fix malformed json
pwistbac Feb 23, 2026
21fecca
Remove trailing comma
pwistbac Feb 24, 2026
38cc39e
Add service for the filer s3
pwistbac Feb 24, 2026
4a13c99
(only for testing) point airm to seaweedfs s3
pwistbac Feb 24, 2026
5d78cf0
Fix service selector
pwistbac Feb 26, 2026
55f0d5a
Fix api user permissions
pwistbac Mar 2, 2026
129bf21
Testing RWM
pwistbac Mar 3, 2026
3a8f528
Make seaweed configurable via values file
pwistbac Mar 5, 2026
e882f68
Add t-shirt sizes config for seaweedfs filer
pwistbac Mar 6, 2026
a66616f
Only for testing: set airm to use seaweedfs
pwistbac Mar 6, 2026
e7867bf
re-enable the webhook
pwistbac Mar 9, 2026
df76494
Add an init job that creates buckets in seaweed
pwistbac Mar 13, 2026
80a21a0
Fix seaweed s3 svc name in the init job
pwistbac Mar 16, 2026
8a34afb
Add a job that can be run to mirror minio to seaweed
pwistbac Mar 16, 2026
e56a2f0
Remove unnused nodePort patches
pwistbac Mar 16, 2026
368e233
Add seaweedfs web admin component (static password for now)
pwistbac Mar 17, 2026
fa48131
Read the seaweedfs admin passwd from openbao via externalsecret
pwistbac Apr 1, 2026
474ca39
Fix: wrong namespace in es
pwistbac May 12, 2026
b5b7349
fix: rename secret param
pwistbac May 12, 2026
0bd066b
point aiwb to the seaweedfs s3
pwistbac May 12, 2026
fc0f21a
Delete presync hooks which stall keycloak installation
pwistbac May 13, 2026
41f21bb
fix typo in the url parameter
pwistbac May 13, 2026
de1843c
fix: missing quotes for the s3 url
pwistbac May 13, 2026
a8e2815
fix: change s3 url for the currently used aiwb version
pwistbac May 13, 2026
e9d344b
disable webhook due to tls
pwistbac May 13, 2026
a52b5c9
Change mirror command, do not remove files in target seaweed bucket t…
pwistbac May 15, 2026
94b253e
Set the seaweedfs internal svc name in the airm configure script
pwistbac May 18, 2026
9c4c2ba
point the open telemetry collectors to seaweed instead of minio
pwistbac May 18, 2026
4a9661d
Update the documentation (from minio to seaweedfs)
pwistbac May 26, 2026
169085d
Remove minio sources from clusterforge (replaced by seaweedfs)
pwistbac May 27, 2026
1f2fb3c
EAI-1452 swtich httproutes to use envoy-gateway-system
blankdots Jun 5, 2026
658c56f
fix: render argocd application template for oci and https
blankdots Jun 4, 2026
e436634
Remove excess filler in template
pwistbac Jun 9, 2026
b558d66
Fix issue with the templating string ending up in live k8s objects
pwistbac Jun 9, 2026
df6f069
fix: Reconcile static OpenBao secrets instead of skipping
pre Jun 9, 2026
4780622
Revert "Fix issue with the templating string ending up in live k8s ob…
pwistbac Jun 10, 2026
ccf7c01
'Reapply "Fix issue with the templating string ending up in live k8s …
pwistbac Jun 11, 2026
bdadc60
Revert "'Reapply "Fix issue with the templating string ending up in l…
pwistbac Jun 11, 2026
e6afa51
Change syncwave to fix templating issue
pwistbac Jun 11, 2026
b9a4860
Revert "Change syncwave to fix templating issue"
pwistbac Jun 11, 2026
8a1e502
Reapply "'Reapply "Fix issue with the templating string ending up in …
pwistbac Jun 11, 2026
4aa82c0
Make sure the webhook is disabled for seaweedfs operator
pwistbac Jun 11, 2026
181db35
EAI-1452 update components for seaweed CRD
blankdots Jun 12, 2026
bf68248
Merge pull request #747 from silogen/EAI-1452-seaweed-s3-rebased-4
brownzebra Jun 12, 2026
554dbea
Document SeaweedFS S3 secrets and restore Helm-driven OpenBao access …
blankdots Jun 12, 2026
9db4abd
Tune SeaweedFS ExternalSecrets and avoid Argo PVC sync deadlock.
blankdots Jun 12, 2026
8cbdebd
Fix root Argo apps for Kyverno storage policies and SeaweedFS ordering.
blankdots Jun 12, 2026
6237dfd
Order Keycloak CNPG secrets and workload for Argo sync waves.
blankdots Jun 12, 2026
4d97b8c
Merge pull request #746 from silogen/fix-eai-name
brownzebra Jun 12, 2026
3ca86e4
Merge pull request #748 from silogen/EAI-1452-seaweed-s3-rebased-4-sy…
brownzebra Jun 12, 2026
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
11 changes: 11 additions & 0 deletions .github/CODEOWNERS
Original file line number Diff line number Diff line change
@@ -0,0 +1,11 @@
# Each line is a file pattern followed by one or more owners.

# These owners will be the default owners for everything in
# the repo. Unless a later match takes precedence,
# Order is important; the last matching pattern takes the most precedence.

# Teams can be specified as code owners as well. Teams should
# be identified in the format @org/team-name. Teams must have
# explicit write access to the repository.

* @silogen/platform
52 changes: 52 additions & 0 deletions .github/workflows/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,52 @@
# GitHub Actions Workflows

This directory contains CI/CD workflows for cluster-forge.

## Workflow files

| Workflow | Trigger | Purpose |
|---|---|---|
| `helm-chart-checks.yaml` | `pull_request` | Validates Helm charts and Kyverno policy test coverage. |
| `pr-component-validation.yaml` | `pull_request` (path-filtered), `workflow_dispatch` | Validates SBOM/component sync when key files change. |
| `release-pipeline.yaml` | `workflow_dispatch` | Calculates release version, creates prerelease artifact, and publishes SBOM. |

## Workflow details

### `helm-chart-checks.yaml`

- Runs on PR events (`opened`, `synchronize`, `reopened`, `ready_for_review`, `converted_to_draft`).
- Validates `root` chart with all sizing values files (`values`, `values_small`, `values_medium`, `values_large`).
- Lints and templates Kyverno policy charts.
- Enforces Kyverno test coverage (test folder, `kyverno-test.yaml`, resource files, and policy mapping).
- Runs `kyverno test` against generated policy manifests.
- Includes a comprehensive coverage job to ensure all charts under `sources/kyverno-policies` are included in CI.

### `pr-component-validation.yaml`

- Runs on manual dispatch and PRs to `main` when these files change:
- `sbom/components.yaml`
- `root/values.yaml`
- `sbom/*.sh`
- Installs `yq` and executes `sbom/validate-sync.sh`.
- Acts as a gate to keep SBOM/component definitions consistent.

### `release-pipeline.yaml`

- Manual workflow with optional input: `version_override`.
- Job `release`:
- Checks out full history.
- Computes next semantic version (`ietf-tools/semver-action`) unless overridden.
- Warns when `scripts/bootstrap.sh` `LATEST_RELEASE` base version does not match release base version.
- Packages `root/`, `scripts/`, and `sources/` into `release-enterprise-ai-<version>.tar.gz`.
- Creates a GitHub prerelease with generated notes.
- Job `sbom` (depends on `release`):
- Generates SBOM via `sbom/generate-sbom.sh`.
- Renames output to `sbom-<version>-<short-sha>.md`.
- Uploads SBOM asset to the GitHub release with `--clobber`.

## Operating notes

- PR workflows perform validation only and do not publish releases.
- Use **Actions -> Release Pipeline -> Run workflow** to cut a release.
- Set `version_override` when you need a specific tag.
- Keep `LATEST_RELEASE` in `scripts/bootstrap.sh` aligned with the release stream to avoid warnings.
294 changes: 294 additions & 0 deletions .github/workflows/helm-chart-checks.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,294 @@
name: Helm chart checks

on:
pull_request:
types: [opened, synchronize, reopened, ready_for_review, converted_to_draft]

jobs:
root-chart:
runs-on: ubuntu-latest
strategy:
matrix:
values:
[
./root/values.yaml,
./root/values_small.yaml,
./root/values_medium.yaml,
./root/values_large.yaml
]
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Helm
uses: azure/setup-helm@v4.3.0

- name: Helm lint
run: helm lint ./root -f ${{ matrix.values }}

- name: Helm template
run: helm template ./root -f ${{ matrix.values }}

kyverno-policies:
runs-on: ubuntu-latest
strategy:
matrix:
policy-chart:
[
"./sources/kyverno-policies/base",
"./sources/kyverno-policies/storage-local-path"
]
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Helm
uses: azure/setup-helm@v4.3.0

- name: Install Kyverno CLI
# Use the official action
uses: kyverno/action-install-cli@v0.2.0
with:
release: 'v1.17.1'

- name: Check install
run: kyverno version

- name: Validate test coverage for all policies
run: |
echo "=== Validating test coverage for Kyverno policies ==="
VALIDATION_FAILED=false

# Function to check if a policy has corresponding tests
check_policy_tests() {
local policy_chart="$1"
local policy_name="$(basename "$policy_chart")"

echo "Checking test coverage for: $policy_name"

# Check if test directory exists
if [ ! -d "$policy_chart/test" ]; then
echo "❌ ERROR: No test directory found for policy chart: $policy_name"
echo " Expected: $policy_chart/test/"
VALIDATION_FAILED=true
return
fi

# Check if kyverno-test.yaml exists
if [ ! -f "$policy_chart/test/kyverno-test.yaml" ]; then
echo "❌ ERROR: No test configuration found for policy chart: $policy_name"
echo " Expected: $policy_chart/test/kyverno-test.yaml"
VALIDATION_FAILED=true
return
fi

# Extract policy names from templates and verify they have test cases
echo "Validating individual policy test coverage..."

# Generate rendered policies to extract actual policy names
helm template test-release "$policy_chart" > /tmp/rendered-policies.yaml || {
echo "❌ ERROR: Failed to render Helm template for $policy_chart"
VALIDATION_FAILED=true
return
}

# Extract ClusterPolicy names from rendered output
POLICIES=$(grep -E "^kind: ClusterPolicy" /tmp/rendered-policies.yaml -A 10 | grep -E "^\s*name:" | sed 's/.*name: *//' | sort -u)

if [ -z "$POLICIES" ]; then
echo "⚠️ WARNING: No ClusterPolicy resources found in $policy_name"
return
fi

# Check that each policy has test results defined
for policy in $POLICIES; do
if ! grep -q "policy: $policy" "$policy_chart/test/kyverno-test.yaml"; then
echo "❌ ERROR: No test results defined for policy: $policy"
echo " Policy chart: $policy_name"
echo " Missing test results in: $policy_chart/test/kyverno-test.yaml"
VALIDATION_FAILED=true
else
echo "✅ Policy '$policy' has test coverage"
fi
done

# Check for test resource files
TEST_RESOURCES=$(find "$policy_chart/test" -name "*.yaml" -not -name "kyverno-test.yaml" | wc -l)
if [ "$TEST_RESOURCES" -eq 0 ]; then
echo "❌ ERROR: No test resource files found for policy chart: $policy_name"
echo " Expected: At least one test resource YAML file in $policy_chart/test/"
VALIDATION_FAILED=true
else
echo "✅ Found $TEST_RESOURCES test resource file(s)"
fi
}

# Check each policy chart in the matrix
for policy_chart in ${{ matrix.policy-chart }}; do
check_policy_tests "$policy_chart"
echo ""
done

# Fail the job if validation failed
if [ "$VALIDATION_FAILED" = true ]; then
echo ""
echo "💥 VALIDATION FAILED: One or more policies lack proper test coverage"
echo ""
echo "To fix this issue:"
echo "1. Create a 'test' directory in your policy chart"
echo "2. Add 'kyverno-test.yaml' with test configuration"
echo "3. Add test resource YAML files"
echo "4. Ensure all policies defined in templates/ have corresponding test results"
echo ""
echo "See existing policy charts for examples:"
echo "- sources/kyverno-policies/base/test/"
echo "- sources/kyverno-policies/storage-local-path/test/"
exit 1
fi

echo "✅ All policies have proper test coverage!"

- name: Helm lint Kyverno policies
run: helm lint ${{ matrix.policy-chart }}

- name: Helm template Kyverno policies
run: helm template test-release ${{ matrix.policy-chart }} --dry-run

- name: Run Kyverno policy tests
working-directory: ${{ matrix.policy-chart }}/test
run: |
echo "Testing policies in ${{ matrix.policy-chart }}"

# Clean any existing generated files
rm -f policy.yaml

# Generate policies from Helm templates for testing
echo "Generating policies from Helm templates..."
helm template test-release .. > all-resources.yaml

# Extract only Kyverno policies (filter out RBAC and other resources)
echo "Extracting Kyverno policies..."
yq eval 'select(.apiVersion == "kyverno.io/v1")' all-resources.yaml > policy.yaml || {
echo "yq not available, using grep fallback..."
awk '/^---$/ { if (kyverno) print "---"; kyverno=0 } /apiVersion: kyverno\.io/ { kyverno=1 } kyverno' all-resources.yaml > policy.yaml
}

# Validate that policy.yaml was generated correctly
if [ ! -f policy.yaml ]; then
echo "❌ ERROR: Failed to generate policy.yaml"
exit 1
fi

# Check that policy.yaml contains valid Kyverno policies
if ! grep -q "apiVersion: kyverno.io/v1" policy.yaml; then
echo "❌ ERROR: Generated policy.yaml does not contain Kyverno policies"
cat policy.yaml
exit 1
fi

echo "=== Generated policy file ==="
cat policy.yaml
echo ""
echo "=== Test configuration ==="
cat kyverno-test.yaml
echo ""
echo "=== Available test resources ==="
ls -la *.yaml | grep -v policy.yaml | grep -v kyverno-test.yaml || echo "No test resource files found"
echo ""
echo "=== Running Kyverno tests ==="

# Run the tests - Kyverno CLI will find policy.yaml and test resources in current directory
kyverno test . --detailed-results

kyverno-coverage-check:
runs-on: ubuntu-latest
steps:
- name: Checkout repository
uses: actions/checkout@v4

- name: Setup Helm
uses: azure/setup-helm@v4.3.0

- name: Validate all Kyverno policies have tests
run: |
echo "=== Comprehensive Kyverno Policy Test Coverage Validation ==="
VALIDATION_FAILED=false

# Find all Kyverno policy charts
POLICY_CHARTS=$(find sources/kyverno-policies -name "Chart.yaml" -exec dirname {} \; | sort)

if [ -z "$POLICY_CHARTS" ]; then
echo "⚠️ No Kyverno policy charts found in sources/kyverno-policies/"
exit 0
fi

echo "Found Kyverno policy charts:"
for chart in $POLICY_CHARTS; do
echo " - $chart"
done
echo ""

# Matrix of expected policy charts (should match workflow matrix)
EXPECTED_CHARTS="./sources/kyverno-policies/base ./sources/kyverno-policies/storage-local-path"

# Check if all discovered charts are in the CI matrix
for chart in $POLICY_CHARTS; do
chart_path="./$chart"
if ! echo "$EXPECTED_CHARTS" | grep -q "$chart_path"; then
echo "❌ ERROR: Policy chart '$chart' is not included in CI matrix"
echo " Add '$chart_path' to the matrix in .github/workflows/helm-chart-checks.yaml"
VALIDATION_FAILED=true
fi
done

# Validate test coverage for all discovered charts
for policy_chart in $POLICY_CHARTS; do
policy_name="$(basename "$policy_chart")"
echo "Checking test coverage for: $policy_name ($policy_chart)"

# Check if test directory exists
if [ ! -d "$policy_chart/test" ]; then
echo "❌ ERROR: No test directory found for policy chart: $policy_name"
echo " Expected: $policy_chart/test/"
VALIDATION_FAILED=true
continue
fi

# Check if kyverno-test.yaml exists
if [ ! -f "$policy_chart/test/kyverno-test.yaml" ]; then
echo "❌ ERROR: No test configuration found for policy chart: $policy_name"
echo " Expected: $policy_chart/test/kyverno-test.yaml"
VALIDATION_FAILED=true
continue
fi

# Check for test resource files
TEST_RESOURCES=$(find "$policy_chart/test" -name "*.yaml" -not -name "kyverno-test.yaml" | wc -l)
if [ "$TEST_RESOURCES" -eq 0 ]; then
echo "❌ ERROR: No test resource files found for policy chart: $policy_name"
echo " Expected: At least one test resource YAML file in $policy_chart/test/"
VALIDATION_FAILED=true
continue
fi

echo "✅ Policy chart '$policy_name' has proper test structure"
done

# Fail the job if validation failed
if [ "$VALIDATION_FAILED" = true ]; then
echo ""
echo "💥 COMPREHENSIVE VALIDATION FAILED"
echo ""
echo "Policy test coverage requirements:"
echo "1. Every Kyverno policy chart must have a 'test' directory"
echo "2. Every policy chart must have 'test/kyverno-test.yaml'"
echo "3. Every policy chart must have test resource files"
echo "4. Every policy chart must be included in the CI matrix"
echo ""
echo "This ensures all policies are validated on every PR!"
exit 1
fi

echo ""
echo "✅ ALL KYVERNO POLICIES HAVE COMPREHENSIVE TEST COVERAGE!"
echo "🎯 Ready for production deployment"
29 changes: 29 additions & 0 deletions .github/workflows/pr-component-validation.yaml
Original file line number Diff line number Diff line change
@@ -0,0 +1,29 @@
name: PR Component Validation

on:
workflow_dispatch:
pull_request:
branches: [ main ]
paths:
- 'sbom/components.yaml'
- 'root/values.yaml'
- 'sbom/*.sh'

jobs:
validate-components:
runs-on: ubuntu-latest

steps:
- name: Checkout code
uses: actions/checkout@v4

- name: Install yq
run: |
sudo wget -qO /usr/local/bin/yq https://github.com/mikefarah/yq/releases/latest/download/yq_linux_amd64
sudo chmod +x /usr/local/bin/yq

- name: Validate SBOM Sync (Gatekeeper)
working-directory: ./sbom
run: |
chmod +x validate-*.sh
./validate-sync.sh
Loading